Problem/Motivation

Moderated content page could be empty even if the current user has access to "in-moderation" content. Based on my quick analysis, this happens because content_moderation only implements hook_entity_access() and not hook_node_access_records() and hook_node_grants(). Therefore if a user should have access to a moderated content but you have a module X enabled that implements node access hooks then the moderated content won't appear on the Moderated content page. This does not happen because module X works incorrectly. It happens because content_moderation should grant access to a moderated node when Views collects available moderated nodes for a user in query time, but it only does it in "runtime", in other words, when Views have already collected and loaded entities from the database.

Steps to reproduce

* Enable a module that implements hook_node_access_records()/hook_node_grants() for the "view" operation. (Like the node_test module.)
* Enable Content moderation and configure it for an access controlled node type.
* Create limited content creator/moderator roles/users.
* Create content with content creator (or admin) and save it in draft moderation state.
* Login with content moderator and check the "Moderated content" page. Expected result: the created node is visible. Actual behavior: The node is not visible, but by opening the node's path directly, the moderator has access.

Minimum role setup for Content Moderator (for the "Editorial" workflow shipped by the Standard profile):

langcode: en
status: true
dependencies: {  }
id: content_moderator
label: 'Content moderator'
weight: 3
is_admin: null
permissions:
  - 'access content overview'
  - 'access toolbar'
  - 'use editorial transition publish'
  - 'view any unpublished content'
  - 'view latest version'
  - 'view the administration theme'

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet

Comments

mxr576 created an issue. See original summary.

mxr576’s picture

Issue summary: View changes

I have just realised that this could be easily tested with the Standard install profile and the node_test test module.

sam152’s picture

Using the grants system has all sorts of weird semantics, as has been highlighted by a lot of the recent group security releases. Personally I would rather users who need grants to evaluate implementing them for content_moderation as a seperate non-core module.

Inflicting grants on all the users who currently have content moderation installed seems like a really bad idea to me personally.

Adding a related issue, because personally I would love to see node grants be removed from core.

sam152’s picture

Title: Empty result on Moderated content page » Content moderation does not implement node grants and thus doesn't integrate it's permissions with other grant implementing modules
pameeela’s picture

Title: Content moderation does not implement node grants and thus doesn't integrate it's permissions with other grant implementing modules » Content moderation does not implement node grants and thus doesn't integrate its permissions with other grant implementing modules
mxr576’s picture

Adding a related issue, because personally I would love to see node grants be removed from core.

+1, totally agree with that.

But that is a long shot solution, like something lands in Drupal 10 or 15... and until that it lands in core we still need some kind of core/contrib solution that could be used on those sites that are using node grant. New and even veteran Drupal developers are both using node grants bacause this is the "documented solution".

Also I am not following how Search API works nowadays, but as far as I remember, it only supported node grants-based access checking back in the good old days. Would/does it work with entity query alters?

Version: 9.1.x-dev » 9.2.x-dev

Drupal 9.1.0-alpha1 will be released the week of October 19, 2020, which means new developments and disruptive changes should now be targeted for the 9.2.x-dev branch. For more information see the Drupal 9 minor version schedule and the Allowed changes during the Drupal 9 release cycle.

Version: 9.2.x-dev » 9.3.x-dev

Drupal 9.2.0-alpha1 will be released the week of May 3, 2021, which means new developments and disruptive changes should now be targeted for the 9.3.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.3.x-dev » 9.4.x-dev

Drupal 9.3.0-rc1 was released on November 26, 2021, which means new developments and disruptive changes should now be targeted for the 9.4.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

codebymikey’s picture

A contrib module attempting to address this issue has now been published.

https://www.drupal.org/project/content_moderation_node_grants

Ideally this module should be within core to maintain parity.

Version: 9.4.x-dev » 9.5.x-dev

Drupal 9.4.0-alpha1 was released on May 6, 2022, which means new developments and disruptive changes should now be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.5.x-dev » 10.1.x-dev

Drupal 9.5.0-beta2 and Drupal 10.0.0-beta2 were released on September 29, 2022, which means new developments and disruptive changes should now be targeted for the 10.1.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 10.1.x-dev » 11.x-dev

Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened, as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch, which currently accepts only minor-version allowed changes. For more information, see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

mxr576’s picture

morvaim’s picture

I couldn't replicate this problem. If the user has the View any unpublished content then all moderated content is listed regardless of `hook_node_access_records()` and `hook_node_grants()` implementations. Couldn't be that the problem here is that there is a "hidden" step during configuring Content moderation and the Content moderation view needs to be updated, because the Content revision: Moderation state filter needs to be configured and until that no content appears on the moderated content listing page?

morvaim’s picture

Content revision: Moderation state needs to be set, after setting up a Workflow, see attached images.

morvaim’s picture

acbramley’s picture

Priority: Major » Normal

I tend to agree with #3 here, given there's a contrib module for this is this something we need to consider for core? I don't think this is a major bug either

Version: 11.x-dev » main

Drupal core is now using the main branch as the primary development branch. New developments and disruptive changes should now be targeted to the main branch.

Read more in the announcement.